CVE-2026-39850: Yii 2 Local File Inclusion in View rendering

Executive brief

Yii 2 is a popular web development framework. A vulnerability in its page-rendering component allows an attacker to trick the system into reading sensitive files from the server. In some cases, this could lead to a complete takeover of the web application if the attacker can upload or find a way to execute malicious code.

Technical details

The core view rendering method View::renderPhpFile() is vulnerable to Local File Inclusion (LFI) due to a variable name collision. The method calls PHP's extract() function on user-supplied parameters with the EXTR_OVERWRITE flag before requiring the view file. An attacker providing a parameter named '_file_' can overwrite the internal local variable used to determine which file is included. This allows for arbitrary file read of non-PHP files and potential Remote Code Execution (RCE) if the attacker can influence the content of a file on the local filesystem. The issue is fixed in version 2.0.55.

Affected products

• yiisoft yii2 < 2.0.55

Timeline

• 2026-05-09: disclosed: Initial disclosure by reporter khuroohamid
• 2026-05-11: advisory: GitHub Advisory published
• 2026-05-11: patched: Version 2.0.55 released

References

• https://api.github.com/users/khuroohamid
• https://github.com/khuroohamid
• https://api.github.com/users/khuroohamid/gists%7B/gist_id%7D
• https://api.github.com/users/khuroohamid/repos
• https://avatars.githubusercontent.com/u/40837886?v=4
• https://api.github.com/users/khuroohamid/events%7B/privacy%7D